CVE-2026-54721CWE-94code-injection

CVE-2026-54721

High · published August 28, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
53.9
In the wild
Unconfirmed
What it is

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user with permission to configure a UserForms email recipient can use the subject field to run arbitrary code on the server, compromising confidentiality, integrity, and availability. This issue is fixed in versions 6.4.9, 7.0.7, and 7.1.1.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00733 · 53.9th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-28T00:17Z
References (8)
https://github.com/silverstripe/silverstripe-userforms/commit/23c069866900c19b499bfa997d1e251e97491702 · [email protected]https://github.com/silverstripe/silverstripe-userforms/commit/c55494ad7c717b199a3c1663b43a54db5d95604c · [email protected]https://github.com/silverstripe/silverstripe-userforms/pull/1441 · [email protected]https://github.com/silverstripe/silverstripe-userforms/pull/1442 · [email protected]https://github.com/silverstripe/silverstripe-userforms/releases/tag/6.4.9 · [email protected]https://github.com/silverstripe/silverstripe-userforms/releases/tag/7.0.7 · [email protected]https://github.com/silverstripe/silverstripe-userforms/releases/tag/7.1.1 · [email protected]https://github.com/silverstripe/silverstripe-userforms/security/advisories/GHSA-g8wr-r2v2-vqc6 · [email protected]
EPSS history
Timeline
  • 27 AUG 16:52Z
    Silverstripe UserForms: Remote code execution via userforms email subject
    cvelistv5